How scoring works

Each server gets a 0–100 score from public signals. It is a triage signal, not a security audit. Always review code and permissions before connecting an agent to real data. Scores are recomputed each time we refresh our data; the last refresh was October 15, 2026.

Maintenance (40)

Up to 30 points for recent commits, decaying to 0 at about 6 months without a push. Up to 10 for a manageable open-issue load. Archived repositories score 0.

Security hygiene (35)

OSI-approved licence (12), a SECURITY.md disclosure policy (10), a published versioned package or hosted endpoint (6), and repository age over 60 days (7). Brand-new repositories get flagged. These are hygiene signals; we do not scan code for vulnerabilities.

Adoption (25)

Log-scaled GitHub stars (15) and npm weekly downloads (10).

Inclusion rules

We list only servers that are published in the official MCP Registry, link a public GitHub repository, are not archived, and score at least 70. That is currently 4,204 servers out of 43,206 registry entries we looked at (30,579 link a GitHub repository). To avoid one project filling the directory, we show at most 3 entries per repository (the highest scoring) and drop repeated listings with the same name. The registry only verifies a server name against the GitHub account it is published under. If a listing points at a repository owned by a different account, we cannot confirm the publisher owns that code, so we cap its score at 69 (below the listing line) and give it no credit for that repository's stars. GitHub also silently follows repository renames. If the repository a listing points at now redirects to a repository that shares nothing with the listing's own name and description, its stars and activity belong to something else, so the same cap and no-credit rule applies. Ordinary renames of the same project are not penalised. Install commands are assembled from the package metadata the publisher registered (including any subcommand or flag), checked against the package's executables on npm. Featured placement never changes a score.

Where the data comes from

Server names, descriptions, versions and links come from the official MCP Registry. Stars, licence, last push, issue counts and SECURITY.md presence come from the GitHub API. Weekly downloads come from the public npm API. We do not invent or estimate any figure.

Limits

Stars and downloads can be inflated; a high score does not prove a server is safe, and a low score does not prove it is unsafe. If you spot an error in a listing, contact us and we will check it against the sources.